Update logic for resolving verifiers.

Verifiers or installers may not be encryption-aware, or the user may
have disabled them, so we probe pretty deeply during system boot to
resolve them.  Use the new MATCH_SYSTEM_ONLY flag to limit results to
packages on the system image.

When there are multiple matches, pick the one with highest priority
instead of crashing the system.

Switch to updated MATCH_ constants in more places.

Bug: 26250295
Change-Id: Ia7a3b1fb74da6c3b9d2c2edbf1deaa9fb52fc40a